@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/src/cli/publish.ts

@@ -1,341 +0,0 @@
-/**
- * All `publish` logic — the schema-publish step, the admin-catalog register, and
- * the release orchestration tying them together. `run.ts` only parses args and
- * dispatches here.
- *
- * A release has two halves that must stay in sync: the CONTRACT (the `./schema`
- * package on npm, so other domains can `imports`/`implements`/`extends` it) and
- * the DEPLOYMENT (the worker URL in the admin catalog). They run npm-FIRST — npm
- * publish is irreversible, so the catalog is registered only on schema-publish
- * success, never pointing at an unpublished contract.
- *
- * Why `pnpm pack` then `npm publish <tarball>` (not a plain `npm publish`): a
- * schema package ships only `dist` and uses `publishConfig` to repoint
- * main/exports from source `.ts` to `dist` — a field override only PNPM applies,
- * so npm would otherwise publish an entry pointing at unshipped source.
- */
-import { spawn } from 'node:child_process'
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { BOLD, DIM, error, GREEN, info, RESET, warn } from './log.js'
-
-type SchemaPkg = {
-  name?: string
-  version?: string
-  private?: boolean
-  files?: readonly string[]
-  peerDependencies?: Record<string, string>
-  dependencies?: Record<string, string>
-  optionalDependencies?: Record<string, string>
-  publishConfig?: { access?: string }
-}
-
-// ── release orchestration (schema THEN catalog) ──────────────────────────────
-
-/** `publish` (no deploy): publish the schema, then register the deployed URL. */
-export async function runRelease(opts: {
-  projectDir: string
-  origin: string
-  name?: string
-  publicUrl?: string
-  skipSchema: boolean
-  dryRun: boolean
-  otp?: string
-  installByDefault?: boolean
-}): Promise<number> {
-  const schemaCode = await publishSchemaBeforeCatalog(opts.projectDir, opts)
-  if (schemaCode !== 0) return schemaCode
-
-  const url = opts.publicUrl ?? `https://${opts.origin}`
-  if (opts.dryRun) {
-    info(`dry-run: would register ${opts.origin} → ${url} in the admin catalog (not registered).`)
-    return 0
-  }
-  info(`registering ${opts.origin} → ${url} in the admin catalog (no deploy)`)
-  return await registerCatalog(opts.projectDir, opts, url)
-}
-
-/** The `deploy --publish` tail: publish the schema, then register the just-deployed URL. */
-export async function runReleaseAfterDeploy(opts: {
-  projectDir: string
-  origin: string
-  deployedUrl: string
-  name?: string
-  skipSchema: boolean
-  otp?: string
-  installByDefault?: boolean
-}): Promise<number> {
-  const schemaCode = await publishSchemaBeforeCatalog(opts.projectDir, { ...opts, dryRun: false })
-  if (schemaCode !== 0) return schemaCode
-  return await registerCatalog(opts.projectDir, opts, opts.deployedUrl)
-}
-
-/**
- * The schema half of a release. npm publish is irreversible, so it runs FIRST:
- * returns 0 to proceed (published | skipped | no `./schema` package), non-zero to
- * ABORT before the catalog touch — so the catalog never points at an unpublished
- * contract.
- */
-async function publishSchemaBeforeCatalog(
-  projectDir: string,
-  opts: { skipSchema: boolean; dryRun: boolean; otp?: string },
-): Promise<number> {
-  if (opts.skipSchema) return 0
-  if (!existsSync(join(projectDir, 'schema', 'package.json'))) {
-    info('no ./schema package — registering the catalog only.')
-    return 0
-  }
-  const code = await publishSchema({
-    projectDir,
-    schemaDir: 'schema',
-    dryRun: opts.dryRun,
-    ...(opts.otp !== undefined ? { otp: opts.otp } : {}),
-  })
-  if (code !== 0)
-    error(
-      'schema publish failed — NOT registering the catalog (a catalog entry must never point ' +
-        'at an unpublished contract). Fix the schema package and re-run, or pass --skip-schema.',
-    )
-  return code
-}
-
-/**
- * Register a domain's public URL in the admin catalog by shelling out to the
- * operator CLI (`astrale domain publish`). Deliberately a subprocess: all
- * credential/admin-target resolution lives in `@astrale-os/cli`, kept out of
- * this build tool. A missing `astrale` is reported with the exact line to run by
- * hand. The catalog `name` is a short slug (the origin's first label by default),
- * distinct from the FQDN origin and from any `@scope/…` npm package name.
- */
-async function registerCatalog(
-  projectDir: string,
-  opts: { origin: string; name?: string; installByDefault?: boolean },
-  url: string,
-): Promise<number> {
-  const { description } = readPackageMeta(projectDir)
-  const name = opts.name ?? opts.origin.split('.')[0] ?? opts.origin
-  // `--public-url`, not `--url`: the operator CLI reserves `--url` for kernel targeting.
-  const cliArgs = [
-    'domain',
-    'publish',
-    '--origin',
-    opts.origin,
-    '--name',
-    name,
-    '--public-url',
-    url,
-  ]
-  if (description) cliArgs.push('--description', description)
-  if (opts.installByDefault) cliArgs.push('--install-by-default')
-
-  info(`publishing to the admin catalog → astrale ${cliArgs.join(' ')}`)
-  return await new Promise<number>((resolve) => {
-    const child = spawn('astrale', cliArgs, { stdio: 'inherit' })
-    child.on('error', (err) => {
-      if ((err as NodeJS.ErrnoException).code === 'ENOENT')
-        error(
-          `\`astrale\` CLI not found on PATH. Register it by hand:\n      astrale ${cliArgs.join(' ')}`,
-        )
-      else error(`failed to run \`astrale domain publish\`: ${err.message}`)
-      resolve(1)
-    })
-    child.on('exit', (code) => resolve(code ?? 1))
-  })
-}
-
-function readPackageMeta(projectDir: string): { name?: string; description?: string } {
-  try {
-    return JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf8')) as {
-      name?: string
-      description?: string
-    }
-  } catch {
-    return {}
-  }
-}
-
-// ── schema publish ───────────────────────────────────────────────────────────
-
-/**
- * Build a domain's thin schema package and publish it to npm. Operates on the
- * schema PACKAGE (its own package.json), not astrale.config.ts, so it needs no
- * adapter — `publish --schema` runs it config-free.
- */
-export async function publishSchema(args: {
-  projectDir: string
-  /** Schema-package dir. Default: `<projectDir>/schema`, else `<projectDir>`. */
-  schemaDir?: string
-  dryRun: boolean
-  /** 2FA one-time password forwarded to `npm publish`. */
-  otp?: string
-}): Promise<number> {
-  const dir = resolveSchemaDir(args.projectDir, args.schemaDir)
-  if (!dir) {
-    error(
-      `No schema package found (no package.json at ./schema or the current dir). A schema\n` +
-        `  package declares peerDependencies (@astrale-os/kernel-core + kernel-dsl + zod) and a\n` +
-        `  publishConfig that repoints main/exports to ./dist — see domains/shell/schema.`,
-    )
-    return 1
-  }
-
-  const pkgPath = join(dir, 'package.json')
-  let pkg: SchemaPkg
-  try {
-    pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as SchemaPkg
-  } catch (err) {
-    error(`Could not read ${pkgPath}: ${(err as Error).message}`)
-    return 1
-  }
-
-  const problems = preflight(pkg)
-  if (problems.length > 0) {
-    error(`Schema package is not ready to publish (${pkgPath}):`)
-    for (const p of problems) process.stderr.write(`    • ${p}\n`)
-    return 1
-  }
-  const name = pkg.name as string
-  const version = pkg.version as string
-
-  // Idempotent in BOTH modes: a dry-run must skip too, since `npm publish
-  // --dry-run` still validates against the registry and errors on an existing version.
-  if (await isOnRegistry(name, version)) {
-    info(
-      `${BOLD}${name}@${version}${RESET} is already published — ` +
-        (args.dryRun ? `a real run would skip it.` : `bump the version to ship again.`),
-    )
-    return 0
-  }
-
-  const dest = mkdtempSync(join(tmpdir(), 'astrale-schema-pack-'))
-  try {
-    info(`packing ${BOLD}${name}@${version}${RESET} from ${rel(args.projectDir, dir)}`)
-    if ((await runInherit('pnpm', ['pack', '--pack-destination', dest], dir)) !== 0) {
-      error(`pnpm pack failed — see the build output above.`)
-      return 1
-    }
-    const tarball = readdirSync(dest)
-      .filter((f) => f.endsWith('.tgz'))
-      .map((f) => join(dest, f))[0]
-    if (!tarball) {
-      error(`pnpm pack produced no .tgz in ${dest}.`)
-      return 1
-    }
-
-    // `--access` mirrors the manifest's baked publishConfig.access; npm's 2FA
-    // prompt passes through `stdio: 'inherit'` (or `--otp` for non-interactive).
-    const access = pkg.publishConfig?.access ?? 'public'
-    const publishArgs = [
-      'publish',
-      tarball,
-      '--access',
-      access,
-      ...(args.dryRun ? ['--dry-run'] : []),
-      ...(args.otp ? ['--otp', args.otp] : []),
-    ]
-    info(
-      args.dryRun
-        ? `dry-run: ${DIM}npm ${publishArgs.join(' ')}${RESET}`
-        : `publishing ${DIM}(a browser / OTP prompt may appear for 2FA)${RESET}`,
-    )
-    const code = await runInherit('npm', publishArgs)
-    if (code !== 0) {
-      error(
-        `npm publish exited ${code}. An auth error (E401/E404) usually means the session ` +
-          `expired — \`npm login\` and retry.`,
-      )
-      return code
-    }
-    if (args.dryRun) info(`dry-run complete — nothing was published.`)
-    else printPublished(name, version)
-    return 0
-  } finally {
-    try {
-      rmSync(dest, { recursive: true, force: true })
-    } catch {
-      warn(`(non-fatal) could not clean the temp pack dir ${dest}`)
-    }
-  }
-}
-
-/** Locate the schema package: an explicit path, else `<projectDir>/schema`, else `<projectDir>`. */
-function resolveSchemaDir(projectDir: string, explicit?: string): string | undefined {
-  const candidates = explicit
-    ? [join(projectDir, explicit)]
-    : [join(projectDir, 'schema'), projectDir]
-  return candidates.find((c) => existsSync(join(c, 'package.json')))
-}
-
-/** Static guards against the classic schema-publish footguns, before any network call. */
-function preflight(pkg: SchemaPkg): string[] {
-  const problems: string[] = []
-  if (!pkg.name) problems.push('package.json has no "name".')
-  if (!pkg.version) problems.push('package.json has no "version".')
-  else if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pkg.version))
-    problems.push(`"version" ("${pkg.version}") must be an exact semver, not a range.`)
-  if (pkg.private) problems.push('"private": true — remove it to publish.')
-  // Peers, not deps: bundling kernel-core/dsl/zod gives the consumer a 2nd copy
-  // and breaks the def `__brand` identity at compile time.
-  if (!pkg.peerDependencies || Object.keys(pkg.peerDependencies).length === 0)
-    problems.push(
-      'no "peerDependencies" — peer-depend on @astrale-os/kernel-core (+ kernel-dsl, zod).',
-    )
-  if (!pkg.files?.includes('dist'))
-    problems.push('"files" must include "dist" (ship only the built output).')
-  if (!pkg.publishConfig)
-    problems.push('no "publishConfig" — main/types/exports won\'t repoint to ./dist at pack time.')
-  for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies'] as const) {
-    for (const [dep, spec] of Object.entries(pkg[field] ?? {})) {
-      if (/^(link:|file:|workspace:)/.test(spec))
-        problems.push(
-          `${field}["${dep}"] is "${spec}" — npm can't publish that; use a semver range.`,
-        )
-    }
-  }
-  return problems
-}
-
-/** True if `<name>@<version>` already exists on the registry. */
-async function isOnRegistry(name: string, version: string): Promise<boolean> {
-  return await new Promise<boolean>((resolve) => {
-    let out = ''
-    const child = spawn('npm', ['view', `${name}@${version}`, 'version'], {
-      stdio: ['ignore', 'pipe', 'ignore'],
-    })
-    child.stdout?.on('data', (d) => (out += String(d)))
-    child.on('error', () => resolve(false)) // npm missing / not-found / offline → let publish surface it
-    child.on('exit', () => resolve(out.trim().length > 0))
-  })
-}
-
-async function runInherit(cmd: string, cmdArgs: readonly string[], cwd?: string): Promise<number> {
-  return await new Promise<number>((resolve) => {
-    const child = spawn(cmd, cmdArgs as string[], { stdio: 'inherit', ...(cwd ? { cwd } : {}) })
-    child.on('error', (err) => {
-      const c = (err as NodeJS.ErrnoException).code
-      error(
-        c === 'ENOENT'
-          ? `\`${cmd}\` not found on PATH.`
-          : `failed to run \`${cmd}\`: ${err.message}`,
-      )
-      resolve(1)
-    })
-    child.on('exit', (code) => resolve(code ?? 1))
-  })
-}
-
-function printPublished(name: string, version: string): void {
-  process.stdout.write(
-    `\n${GREEN}✓${RESET} published ${BOLD}${name}@${version}${RESET}\n` +
-      `  ${DIM}consume it:${RESET} ${BOLD}import { schema as S } from '${name}'${RESET}` +
-      `${DIM} → imports: [S], implements: [S.interfaces.X]${RESET}\n` +
-      `  ${DIM}and add ${BOLD}requires: ['<this-origin>']${RESET}${DIM} on the consumer ` +
-      `(producer installs first).${RESET}\n\n`,
-  )
-}
-
-function rel(from: string, to: string): string {
-  return to.startsWith(from) ? `.${to.slice(from.length) || '/'}` : to
-}